Improper Public Key Authentication in cURL Affects Multiple Users

CVE-2025-15224

What is CVE-2025-15224?

A vulnerability in cURL during SSH-based file transfers using SCP or SFTP can lead to improper public key authentication. When users are prompted for public key authentication, cURL incorrectly interacts with a locally running SSH agent, potentially allowing unauthorized access during transfers. This issue underscores the need for users to ensure they are using secure configurations to mitigate risks.

References